October 2026 Security Incidents: PHP2Shell, eMudhra and LiteLLM

Between October 17 and October 21, 2026, four security events hit software that large parts of the internet run on:

two critical remote code execution flaws in PHP (“PHP2Shell”)
compromised keys at the certificate authority eMudhra
a batch of Node.js security fixes
a poisoned release of the Python AI library LiteLLM

In short for Safina customers: Safina does not use PHP or LiteLLM. We checked every report right after it became public and upgraded the affected dependencies. You don’t need to do anything in your Safina account. How we responded · What you should check yourself

Last updated: October 22, 2026. We will update this article as new information comes in.

The October 2026 Incidents at a Glance

Incident	What it affects	Fix
PHP2Shell October 21 · critical	Every PHP installation that serves web requests	PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35
eMudhra intermediate CA keys October 17 · forged certificates possible	Software that trusts the root “emSign ECC Root CA - G3”	Updated browsers and trust stores, new certificates for affected sites
Node.js security releases October 21 · 4 high-severity flaws	Node.js 22.x, 24.x and 26.x	Node.js 22.23.4, 24.22.1 or 26.12.1
LiteLLM 1.107.0 October 21 · credential stealer and backdoor	Systems that installed LiteLLM 1.107.0 from PyPI or pulled its Docker images	LiteLLM 1.106.2, credential rotation

PHP2Shell: Critical Remote Code Execution in PHP

PHP2Shell is the name for two critical vulnerabilities in the PHP interpreter, CVE-2026-109618 and CVE-2026-109619. Both allow an attacker to run code on a server with a single unauthenticated web request, before any application code runs. The PHP team rates both at 9.2 on the CVSS 4.0 scale and released fixes on October 21, 2026.

PHP runs WordPress, many online shops, booking plugins and web hosting control panels. That makes this one of the widest-reaching flaws in years. Security researcher Kevin Beaumont told Help Net Security: “The PHP situation will lead to a mass of incidents – it’s one of the biggest vulns in years.”

What is affected: According to Help Net Security, every PHP setup that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The vulnerable code path goes back to PHP 5.4, according to Tenable.

Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 7.4 to 8.1 get no official release, only minimal source backports.

Timeline: The CVE identifiers leaked on October 20. The PHP Foundation then moved the release forward by one day, from October 22 to October 21, Tenable reports. Amazon Threat Intelligence saw a first exploitation attempt on October 17, four days before the fix, and reports broad exploitation since then. CISA had not observed exploitation when it published its alert, but tells organizations to take unpatched PHP systems offline, as well as all systems on PHP 8.1 or older.

Cloudflare added web application firewall rules for the known attack patterns, also for free plans. Cloudflare calls this a stopgap: only the update fixes the flaw.

Status on October 22: After the release, security firms such as watchTowr and Patchstack reported active exploitation attempts. According to CyberScoop, Huntress had not confirmed a successful attack on customer systems. CyberScoop estimates that more than 1.3 million servers reachable from the internet could be vulnerable. CISA has not yet added the two flaws to its catalog of known exploited vulnerabilities.

eMudhra: Compromised Certificate Authority Keys

Certificate authorities (CAs) issue the certificates that make the padlock in your browser mean something. On October 17, 2026, a researcher reported that the private keys of eight intermediate CA certificates from the Indian CA eMudhra had been generated with weak randomness. Anyone could have calculated these keys and issued a certificate for any website that browsers and apps would trust.

The response was fast. According to Google, Chrome blocked the affected intermediates less than two hours after the report, without a browser update. Android devices received the block on October 19 through Google Play Services. Google found no certificate from these CAs in the public Certificate Transparency logs before the block. Mozilla removed the root “emSign ECC Root CA - G3” from Firefox’s trust store (Mozilla bug 2083449), and Chrome removes it on October 27, 2026. Firefox blocked the intermediates on October 17 as well, Apple followed on October 19 and Microsoft on October 20 (CyberInsider). eMudhra traces the weak keys to a faulty script during a key generation ceremony and no longer issues certificates under the G3 root.

The harder part is software outside the browser. Servers, containers and programming languages often bring their own list of trusted CAs, and most of them cannot block single intermediates. They need an update that removes the whole root. The Python package certifi, for example, no longer contains it since version 2026.10.18, and the advisory names 2026.10.19 as the fixed release (GitHub advisory). Two of the eight intermediates were code-signing CAs, so the risk also covers signed software, not only websites.

Node.js October 2026 Security Releases

On October 21, 2026, the Node.js project released security fixes for all supported release lines: 22.23.4, 24.22.1 and 26.12.1. The releases fix 10 vulnerabilities, 4 of them rated high:

two ways to bypass the TLS hostname check with unusual IP address notations
an out-of-bounds write in the Brotli decoder that can allow remote code execution
a dns.resolve flaw that cuts off host names at a NUL character

The same releases also remove the compromised eMudhra root from the certificate list that Node.js ships with. End-of-life versions such as Node.js 20 are affected too and get no fix.

LiteLLM 1.107.0: A Supply Chain Attack on an AI Library

LiteLLM is a popular Python library that connects applications to many AI model providers. On October 21, 2026, attackers published version 1.107.0 to PyPI and to the project’s Docker images (tags v1.107.0, latest, main-latest and main-stable). The release contained a credential stealer and a backdoor.

According to Datadog Security Labs, the malicious release was available for about two hours. Its files run every time Python starts, even if LiteLLM is never imported, and they stay on the system after an uninstall. The stealer collected cloud keys, API keys for AI providers, SSH keys and browser credentials. Chainguard counts this as the second compromise of LiteLLM in seven months.

According to LiteLLM’s own incident report, the attackers used stolen GitHub credentials of developer accounts and pointed the release workflow at a lookalike repository. The source code in the official repository did not contain the malicious files. The package was on PyPI from 11:39 to about 13:23 UTC, and the Docker tags pointed to the malicious image until 14:20 UTC. Customers of the private enterprise release were not affected.

The last safe version is 1.106.2. Anyone who installed 1.107.0 should treat the system as compromised, remove the injected files, and rotate every credential the system could reach from a clean machine.

How Safina Responded

Safina answers your business calls, so the systems behind it have to be both available and safe. Security is a priority for us, and automatic security monitoring has always been part of how we run Safina. This is how it worked during these incidents:

Automatic monitoring. Our code, dependencies and container images are scanned automatically. When a security advisory affects a component we use, we get an alert and an update request, without waiting for someone to read the news.
Checks right after disclosure. For each of the four incidents, we checked right after it became public whether and where Safina uses the affected software.
Upgrades. We moved our services to the patched Node.js releases and updated the trusted certificate lists in our services.
Not in use. Safina does not run PHP and does not use LiteLLM. Our check of all code and dependencies confirmed this.

You do not need to do anything in your Safina account. The updates run on our side. If you want to know more about how we handle your data, read our privacy and compliance overview and our article on GDPR and AI phone assistants.

What Small Businesses Should Check Now

You probably do not run servers yourself. But your website, online shop or booking tool may run on PHP. These five checks cover the most common cases:

Ask your web host or agency whether your website runs on a PHP version with the fix (8.5.12, 8.4.27, 8.3.36 or 8.2.35). This applies to most WordPress sites.
Plan a move away from PHP 8.1 or older. These versions get no official fix. CISA recommends taking such systems offline.
Update browsers, phones and computers. Chrome, Firefox, Android, Apple and Microsoft devices block the eMudhra certificates through their normal updates.
Check your certificate issuer if your own website uses a certificate from eMudhra (emSign). Chrome stops trusting the “emSign ECC Root CA - G3” root on October 27, 2026. Get a new certificate from another CA before then.
Ask your IT provider about LiteLLM if you run your own AI tools. If version 1.107.0 was installed, the system needs cleaning, and every key on it needs to be replaced.

Why AI Makes Patch Speed Matter More

Wiz researchers said about PHP2Shell: “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit” (Help Net Security). AI models now help defenders find old bugs, as Anthropic showed with Claude Mythos and Project Glasswing. The same tools help attackers turn a published fix into a working attack faster.

The time between disclosure and the first attacks keeps getting shorter. For PHP2Shell, the first attempts came before the fix was even out. Automatic monitoring and fast updates are no longer extras for a software provider. They are the baseline.

Frequently Asked Questions

Is Safina affected by PHP2Shell?

No. Safina does not run PHP. Our website, apps and backend services use other technologies. We checked this right after the vulnerabilities became public.

Do I need to change anything in Safina?

No. All updates run on our side. Your assistant, your phone number and your settings stay as they are.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on October 21, 2026. PHP 8.1 and older get no official release. Ask your web host which version your website uses.

What was the eMudhra incident?

The private keys of eight intermediate certificates from the certificate authority eMudhra were generated with weak randomness. Anyone could have used them to create trusted certificates for any website. Chrome and Firefox blocked them within hours of the report, Apple and Android two days later and Microsoft three days later, and the root “emSign ECC Root CA - G3” is being removed from trust stores.

Which LiteLLM version is safe?

LiteLLM 1.106.2 is the last safe version. Version 1.107.0 from October 21, 2026, contained a credential stealer. Systems that installed it need cleaning and new credentials.

Timeline

Date (2026)	Event
October 17	Report on the weak eMudhra keys. Chrome and Firefox block the affected intermediates the same evening. First PHP2Shell exploitation attempt seen by Amazon.
October 19	Apple blocks the eMudhra intermediates. Android receives the block through Google Play Services.
October 20	PHP2Shell CVE identifiers leak. PHP announces the security release for the next day. Microsoft blocks the eMudhra intermediates.
October 21	PHP and Node.js release security fixes. Malicious LiteLLM 1.107.0 is published and removed after about two hours. CISA publishes its PHP alert. Security firms report the first exploitation attempts after the PHP release.
October 27	Chrome removes the “emSign ECC Root CA - G3” root from its root store.